luottotietolaki

Luottotietolaki is a Finnish law that governs the processing of credit information in Finland. It regulates how credit information registries and providers collect, store, and use data about individuals and businesses, and how such information may be used by lenders, insurers, landlords, and employers in decisions related to credit, insurance, employment, or tenancy. The aim is to ensure that credit information is accurate, secure, and used only for legitimate purposes.

The scope covers data such as payment history, defaults, and other indicators of creditworthiness, as well as information shared between registries and third parties. The law specifies allowed purposes for processing and sets limits on who may access credit information, typically those with a legitimate need for a credit decision or contractual obligation. It also addresses data sharing, data quality requirements, and retention practices.

Data subjects have rights under Luottotietolaki, including the right to access their own credit information, the right to request corrections, and the right to be informed about who has accessed their data. The statute governs the accuracy of records, retention periods, and, in some cases, restrictions on automated decision-making. Consent and lawful bases for processing are addressed, particularly for non-essential data processing.

Responsibilities fall on credit information providers and data controllers to ensure data quality, security, and timely updates, and to provide clear notices about data collection and purposes. Compliance is overseen by Finnish supervisory authorities, with possible administrative penalties for violations. The act aligns with the broader European data protection framework, notably the EU General Data Protection Regulation, and integrates national rules on data protection and consumer rights.